Scope orphaned-event cleanup to recent ingest window to eliminate 8-hour ES CPU spikes

[Copilot]

Orphaned data cleanup runs every 8 hours and was scanning event history across all time for missing stacks/projects/organizations, driving periodic Elasticsearch CPU spikes. This change narrows orphan-event detection to the same practical submission window (last 3 days), reducing query fanout and delete scope.

• What changed

  • Added a fixed lookback window in CleanupOrphanedDataJob:
    • OrphanedEventLookback = TimeSpan.FromDays(3)
  • Applied the cutoff to all orphaned-event passes:
    • stack-based orphan detection
    • project-based orphan detection
    • organization-based orphan detection

• Query/deletion behavior update

  • Cardinality + terms aggregations now run only on events with CreatedUtc >= cutoff.
  • DeleteByQuery now uses a bool/filter combining:
    • missing parent IDs (terms)
    • recent-event cutoff (date_range on CreatedUtc)

• Regression coverage

  • Added CanDeleteOnlyRecentOrphanedEventsByStack to verify:
    • recent orphaned events are removed
    • older orphaned events remain untouched

var cutoff = _timeProvider.GetUtcNow().UtcDateTime.Subtract(TimeSpan.FromDays(3));

await _elasticClient.DeleteByQueryAsync<PersistentEvent>(r => r.Query(q => q.Bool(b => b
    .Filter(
        f => f.Terms(t => t.Field(e => e.StackId).Terms(missingStackIds)),
        f => f.DateRange(d => d.Field(e => e.CreatedUtc).GreaterThanOrEquals(cutoff))))));

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}